FKIE_CVE-2014-0648

Vulnerability from fkie_nvd - Published: 2014-01-16 19:55 - Updated: 2025-04-11 00:51
Severity ?
Summary
The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187.
References
psirt@cisco.comhttp://osvdb.org/102117
psirt@cisco.comhttp://secunia.com/advisories/56213
psirt@cisco.comhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacsVendor Advisory
psirt@cisco.comhttp://tools.cisco.com/security/center/viewAlert.x?alertId=32379Vendor Advisory
psirt@cisco.comhttp://www.securityfocus.com/bid/64962Third Party Advisory, VDB Entry
psirt@cisco.comhttp://www.securitytracker.com/id/1029634Third Party Advisory, VDB Entry
psirt@cisco.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/90431
af854a3a-2127-422b-91ae-364da2661108http://osvdb.org/102117
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/56213
af854a3a-2127-422b-91ae-364da2661108http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacsVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://tools.cisco.com/security/center/viewAlert.x?alertId=32379Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/64962Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1029634Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/90431
Impacted products
Vendor Product Version
cisco secure_access_control_system *
cisco secure_access_control_system 5.1
cisco secure_access_control_system 5.1.0.44
cisco secure_access_control_system 5.1.0.44.1
cisco secure_access_control_system 5.1.0.44.2
cisco secure_access_control_system 5.1.0.44.3
cisco secure_access_control_system 5.1.0.44.4
cisco secure_access_control_system 5.1.0.44.5
cisco secure_access_control_system 5.2
cisco secure_access_control_system 5.2.0.26
cisco secure_access_control_system 5.2.0.26.1
cisco secure_access_control_system 5.2.0.26.2
cisco secure_access_control_system 5.3.0.40.1
cisco secure_access_control_system 5.3.0.40.2
cisco secure_access_control_system 5.3.0.40.3
cisco secure_access_control_system 5.3.0.40.4
cisco secure_access_control_system 5.3.0.40.5
cisco secure_access_control_system 5.3.0.40.6
cisco secure_access_control_system 5.3.0.40.7
cisco secure_access_control_system 5.3.0.40.8
cisco secure_access_control_system 5.3.0.40.9
cisco secure_access_control_system 5.4.0.46.1
cisco secure_access_control_system 5.4.0.46.2
cisco secure_access_control_system 5.4.0.46.3
cisco secure_access_control_system 5.4.0.46.4
cisco secure_access_control_system 5.4.0.46.5
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D9A609B-4E75-4B2B-9BE9-D179F3502CF5",
              "versionEndIncluding": "5.4.0.46.6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A2CF8363-45D0-43C8-B7B9-3F6BC2234A30",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44:*:*:*:*:*:*:*",
              "matchCriteriaId": "07DE9E4E-2F14-4A31-AFC3-154B1844AE03",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "401107FC-A04B-4375-8C3C-33E7180EDA16",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE77C1EB-585A-453E-80C4-D5CE79A99B50",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6BC5C61-A23C-4536-B659-75520AC5129C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8F31E15C-954C-47BF-A461-D4051ADAF1FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.1.0.44.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "BE8F7733-1E65-4D6C-91D0-6E0D56F1BD28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "04BBADC0-EAAB-49D8-94B3-4DA6F308BD77",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.2.0.26:*:*:*:*:*:*:*",
              "matchCriteriaId": "0BD85C33-787C-4495-A37F-842098361872",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.2.0.26.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "09622F03-6BEB-483F-9A67-1E6F78536C61",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.2.0.26.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1922B2DD-14C3-458E-9F41-46262B98EC60",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "9F48EBAF-7FFB-40BB-B4C0-706C89609752",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DBFC6EA-4EE2-4BF7-A54B-F6E7C1BF9A1C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6DC87D9B-818E-46AE-9F33-A00C3292D5FB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "A1D809F4-86DC-4681-9676-8CFA004BA520",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "3D170305-A11C-423F-BECD-5AAF1557D3AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "8DC868F0-4F2E-42CD-9D14-4755478720A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A7AF15C-F403-4C70-BBE9-C27DF6D24D93",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "F7EC6DB7-DB4C-4E47-928B-8BB6C665BD97",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.3.0.40.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "87CFC9B9-51EA-4BA9-98C2-FCBF32F22022",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.4.0.46.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "54058C70-3D37-45DB-BC81-402A2B1ECD7D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.4.0.46.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1F938D66-B431-4146-B963-A75822DBD159",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.4.0.46.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "ADA79AAA-8FD7-4731-B186-118638412E8E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.4.0.46.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD5B019C-3848-47FA-8212-C40A11CC3815",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:cisco:secure_access_control_system:5.4.0.46.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "468969AE-EDA4-49EC-965E-D7AEBA2D6272",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The RMI interface in Cisco Secure Access Control System (ACS) 5.x before 5.5 does not properly enforce authentication and authorization requirements, which allows remote attackers to obtain administrative access via a request to this interface, aka Bug ID CSCud75187."
    },
    {
      "lang": "es",
      "value": "El interface RMI en Cisco Secure Access Control System (ACS) v5.x anterior a v5.5 no aplica correctamente los requisitos de autenticaci\u00f3n y autorizaci\u00f3n, lo que permite a atacantes remotos obtener acceso administrativo a trav\u00e9s de una solicitud a este interface, tambien conocido como Bug ID CSCud75187."
    }
  ],
  "id": "CVE-2014-0648",
  "lastModified": "2025-04-11T00:51:21.963",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": true,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 10.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2014-01-16T19:55:04.637",
  "references": [
    {
      "source": "psirt@cisco.com",
      "url": "http://osvdb.org/102117"
    },
    {
      "source": "psirt@cisco.com",
      "url": "http://secunia.com/advisories/56213"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32379"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/64962"
    },
    {
      "source": "psirt@cisco.com",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1029634"
    },
    {
      "source": "psirt@cisco.com",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90431"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://osvdb.org/102117"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/56213"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140115-csacs"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://tools.cisco.com/security/center/viewAlert.x?alertId=32379"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securityfocus.com/bid/64962"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "url": "http://www.securitytracker.com/id/1029634"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90431"
    }
  ],
  "sourceIdentifier": "psirt@cisco.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.